[Acer PT14-51 Laptop] HowTo

[jalavoui]

so only issue is powewell call - maybe you can find a new patch. linux says no pg2 for your card

and

test the firmware loading

 

still we don't really know where the problem is

 

you can also try to test the production version. check what needs tobe enabled/disabled. the stolen memory warn can be fixed in laptop bios

 

 

and now that youre not so bad at coding you can try system icl framebuffer

 

linux check always help. there are so many for your display. 

 

 

this1 is funny

 

Edited November 24, 2024 by jalavoui

[Stezza88]

BTW i don't give up, if I put like this

modeDescription!=nullptr && timing != (IODetailedTimingInformationV2 **)0x0

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, IODetailedTimingInformationV2 **timing){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	if (modeDescription!=nullptr && timing != (IODetailedTimingInformationV2 **)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));
		(*displayTimingInfo)->pixelClock = 785400000;
	}
	return ret;
}

got different kp at "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN21AppleIntelFramebuffer19getPixelInformationEiiiP18IOPixelInformation + 0x65"

Kernel-2024-11-24-102022.panic

Edited November 24, 2024 by Stezza88

[Stezza88]

Could u look to this line too?

I can't still understand where to look these lines "__ZN21AppleIntelFramebuffer19getPixelInformationEiiiP18IOPixelInformation + 0x65"

 

For exemple, if i have a kp like this i must read in line 65 or i must convert in decimal and look at line 101 ? I think 101.... it fails in the equality...

 

 

 

then, it's to difficult to implement... wtf

 

Have implemented like this but give obviously same error

unsigned long Gen11::getPixelInformation (void *that, uint param_1,int param_2,int param_3, void *param_4){
	return FunctionCast(getPixelInformation, callback->ogetPixelInformation)(that,param_1,param_2, param_3, param_4);
}

unsigned long Gen11::getPixelInformation (void *that, uint param_1,int param_2,int param_3, IOPixelInformation *param_4){
	return FunctionCast(getPixelInformation, callback->ogetPixelInformation)(that,param_1,param_2, param_3, param_4);
}

Edited November 24, 2024 by Stezza88

[Stezza88]

BTW, we have this limit to notice 

[initTimingRange ]     (minClock=20000000, maxClock=720000000)

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7366 ][hwGetMemoryLayoutEFI]     FB0: err = 0x0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7330 ][hwGetMemoryLayoutEFI]     FB1
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7366 ][hwGetMemoryLayoutEFI]     FB1: err = 0xe00002c7
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp :11570 ][SMCNotificationHandl]     AppleSMC driver found
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp :11584 ][SMCNotificationHandl]     SMC backlight color enable key 0x4c445345 not found 0x84
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 2411 ][start               ]     Starting FB: 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp : 1853 ][initTimingRange ]     (minClock=20000000, maxClock=720000000)

we want to go over the maxclock range interval, maybe is this the problem

 

Logs with these methods added are suspending here

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 1312 ][SafeForceWake       ]     2D ForceWakeValue: 0, fForceWakeCount[Default] 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7330 ][hwGetMemoryLayoutEFI]     FB0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7357 ][hwGetMemoryLayoutEFI]     FB0: UpperFence 0 LowerFence 0 baseAddress 0 endAddress 0 stride 0 valid 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7366 ][hwGetMemoryLayoutEFI]     FB0: err = 0x0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7330 ][hwGetMemoryLayoutEFI]     FB1
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 7366 ][hwGetMemoryLayoutEFI]     FB1: err = 0xe00002c7

x.log

Edited November 24, 2024 by Stezza88

[jalavoui]

add 0x65 to 0x498BC

 

 

the kp is after calling validateModeDepth

 

 

problem is kp not clocks. but you can do this

you will get the list of waht calls it. then you can do a function patch

 

here it is

 

Edited November 24, 2024 by jalavoui

[Stezza88]

21 minutes ago, jalavoui said:

the kp is after calling validateModeDepth

 

validateDisplayMode.. it isn't still configured correctly

 

ulong uVar2;

undefined8 local_50;

long local_38;

uint param_1

 

uVar2 = validateDisplayMode(this,param_1,&local_50,&local_38);

 

we declared as

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, IODetailedTimingInformationV2 **timing)

This is so strange..

Edited November 24, 2024 by Stezza88

[jalavoui]

gonna upload nblue again cause i forget to revert some changes in FeatureControl in tgl frameb

dpm was off etc

gonna fix it

 

get the info.plist again maybe it helps cause some properties were disabled

got no more ideas for validateDisplayMode()

Edited November 24, 2024 by jalavoui

[Stezza88]

Want to try more generic fun

void *Gen11::validateDisplayMode(void *framebuffer, uint param_1, void *param_2, void *param_3){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,param_1,param_2,param_3);
	if (param_2!=nullptr && param_3 != (IODetailedTimingInformationV2 *)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<IODetailedTimingInformationV2 *>(param_3));
		if(displayTimingInfo != nullptr)
			displayTimingInfo->pixelClock = 785400000;
	}
	return ret;
}

With this got kp at "com.apple.iokit.IOGraphicsFamily : __ZN13IOFramebuffer4openEv + 0xb9f"

Kernel-2024-11-24-141928.panic

Edited November 24, 2024 by Stezza88

[Stezza88]

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
/* AppleIntelBaseController::GetLinkConfig(AGDCLinkConfig_t*, AGDCLinkConfig_t*) */

undefined8 __thiscall
AppleIntelBaseController::GetLinkConfig(AppleIntelBaseController *this,uint *param_1,long para m_2)

at

__ZN24AppleIntelBaseController13GetLinkConfigEP16AGDCLinkConfig_tS1_

Edited November 24, 2024 by Stezza88

[Stezza88]

I'm trying this implementation

void *Gen11::validateDisplayModeL(void *framebuffer, uint param_1, void *param_2, void *param_3){
	auto ret =FunctionCast(validateDisplayModeL,callback->ovalidateDisplayModeL)(framebuffer,param_1,param_2,param_3);
	return ret;
}

void *Gen11::validateDisplayMode(void *framebuffer, uint param_1, void *param_2, void **param_3){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,param_1,param_2,param_3);
	if (param_2!=nullptr && (IODetailedTimingInformationV2 *)param_3 != (IODetailedTimingInformationV2 *)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<IODetailedTimingInformationV2 *>(param_3));
		if(displayTimingInfo != nullptr)
			displayTimingInfo->pixelClock = 785400000;
	}else{
		return validateDisplayModeL(framebuffer, param_1, param_2, (long *) param_3);
	}
	return ret;
}

but get kp at com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN20IntelFBClientControl11doAttributeEjPmmS0_S0_P25IOExternalMethodArguments + 0x48e

is after the call at this jump the kp (e6db4 + 48e = E7242)

__text:00000000000E723D                 call    __ZN24AppleIntelBaseController13GetLinkConfigEP16AGDCLinkConfig_tS1_
__text:00000000000E7242                 jmp     loc_E78B7

Edited November 24, 2024 by Stezza88

[jalavoui]

void *Gen11::validateDisplayMode ????

 

wtf validateDisplayMode is not a void *

 

all you doing is getting new bugs

[Stezza88]

5 hours ago, Stezza88 said:

BTW i don't give up, if I put like this

modeDescription!=nullptr && timing != (IODetailedTimingInformationV2 **)0x0

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, IODetailedTimingInformationV2 **timing){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	if (modeDescription!=nullptr && timing != (IODetailedTimingInformationV2 **)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));
		(*displayTimingInfo)->pixelClock = 785400000;
	}
	return ret;
}

got different kp at "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN21AppleIntelFramebuffer19getPixelInformationEiiiP18IOPixelInformation + 0x65"

Kernel-2024-11-24-102022.panic 6.74 kB · 0 downloads

 

This is the solution more quoted

[Stezza88]

Also this

unsigned long Gen11::validateDisplayMode(void *framebuffer, uint mode, void *modeDescription, void **timing){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	if (modeDescription!=nullptr && timing!=nullptr && (IODetailedTimingInformationV2 **) timing != (IODetailedTimingInformationV2 **)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));
		if(displayTimingInfo!=nullptr && *displayTimingInfo != nullptr)
			(*displayTimingInfo)->pixelClock = 785400000;
	}
	
	return ret;
}

give kp at "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN21AppleIntelFramebuffer19getPixelInformationEiiiP18IOPixelInformation + 0x65"

[Stezza88]

From tomorrow i try icl framebuffer..

 

But.. you have ghidra for mac? Because i found only win version

Edited November 24, 2024 by Stezza88

[Stezza88]

An other thing.. after analyze the content i got

 

 

but u get this

 

what i'm doing wrong with types?

i put select all on code analize tool

Edited November 24, 2024 by Stezza88

[jalavoui]

ghidra install on mac just by copying to a folder

this is contents of ghidra_11.0.1_PUBLIC folder

 

 

https://github.com/NationalSecurityAgency/ghidra/releases

 

https://www.oracle.com/pt/java/technologies/downloads/#jdk21-mac

 

latest

 

 

never use windows for mac os development - that is why you get that decompile junk results

Edited November 24, 2024 by jalavoui

[jkbuha]

What would be the main reasons to prevent second boot from initialising when the correct IDs are inserted under AppleIntelFramebufferControllerTGLle?

 

Using device id 46a6 - current results with latest nblue and HookedCase:

 

1. No IDs - system boots (ofc because nblue not initalised so defaults to vesa)

2. IDs in AppleIntelFramebufferControllerICLle - system freezes on second boot after showing a lot of IGPU debug code

3. IDs in AppleIntelFramebufferControllerTGLle - no freeze but system remains in text mode (IGPU stalled errors)

Edited November 25, 2024 by jkbuha

[jalavoui]

the "le" is used to load kexts installed in /Library/Extensions.

If something is wrong with the kext install the driver hangs (wrong permission or wrong kext or missing kext)

 

latest nblue already as all ids by default. you can move them to test another framebuffer. 

AppleIntelFramebufferControllerICL is in system/library/extension

Gen7xxx are for graphics loading

sometimes i forget to delete id's from gen7 and that cause hang to ppl who don't have them installed

nblue is hanging for non tgl cards but you should get some kind of log depending on your card - probably a kernel panic

 

 

 

Edited November 25, 2024 by jalavoui

[Stezza88]

I'm in pause, thanks

[Stezza88]

- Gem7ICL : work but AppleICLGraphics too old can only SSH at the end (-disablegfxfirmware)
- TGLle : work in progres..
- ICLLP, ICLLE, Gen7TGL : still to improve..

[Stezza88]

they need permissions fix so before move to /L/E do in some random folder

chmod -R 755 test/Apple*

chown -R root:wheel test/Apple*

move the files to /L/E

delete /Library/KernelCollections/AuxiliaryKernelExtensions.kc

redo chown -R root:wheel /Library/Extensions/Apple*

sudo kmutil load -p /Library/Extensions/AppleIntelTGLGraphics.kext 2>&1

sudo kextcache -i /

 

log show --style syslog --predicate 'processID == 0' --last 10m --info --debug  > /tmp/x.log

grep "\[IGFB\]" /tmp/x.log > /tmp/b.log

 

sudo diskutil mount disk0s1

 

kextstat | grep -i tgl

 

sudo codesign -f -s - /Library/Extensions/AppleIntelTGLGraphics.kext

Edited April 10 by Stezza88